Your contacts.
Yours alone.

Stackit is a personal CRM operated by Innovas Pte. Ltd., a company registered in Singapore. We treat your contact data as personal property — not as a corporate asset to be mined or sold.

This page summarises what we collect, why, and how we keep it safe. The intent is plain English; legal effect remains as written.

Account: email, name and an opaque Cognito user ID. Used to authenticate your sessions and route data to your account.

Contacts you create: names, companies, roles, contact details, tags, notes, and any business-card images you scan. Stored on your device with encrypted backup to your Stackit cloud account.

Usage telemetry: anonymised crash reports and high-level event counts (e.g. "contact created", "sync completed"). Never includes the contents of your contacts.

We do not access, share, or sell the contents of your contacts, notes, or calendar with anyone, including employers, advertisers, or AI training providers.

We do not require access to your device address book to use Stackit.

On-device data is held in an encrypted local store (Hive on mobile, browser storage on web). Cloud backup uses AWS DynamoDB and S3 in the ap-southeast-1 (Singapore) region under per-user partition isolation.

Business-card images are stored privately and surfaced only via short-lived presigned URLs.

When you use the in-app Stackit Agent, your prompt and the relevant slice of your CRM data (only the records the agent needs to answer) are sent to AWS Bedrock for inference. Results are returned to your device and the prompt + response pair is not used to train any third-party model.

Access, export and deletion: Settings → Account → Export / Delete Account performs a full export and a hard delete (removes the user, all contacts, notes, calendar events, agent sessions, and tracking metadata).

Questions or requests: email privacy@stackit.app.

If we materially change how data is handled, we will post the updated policy here and surface a notice in-app before the change takes effect.